diff --git a/checks/check21 b/checks/check21 index 383578e3..2d8bc952 100644 --- a/checks/check21 +++ b/checks/check21 @@ -9,7 +9,7 @@ # work. If not, see . CHECK_ID_check21="2.1,2.01" -CHECK_TITLE_check21="[check21] Ensure CloudTrail is enabled in all regions (Scored)" +CHECK_TITLE_check21=" Ensure CloudTrail is enabled in all regions (Scored)" CHECK_SCORED_check21="SCORED" CHECK_TYPE_check21="LEVEL1" CHECK_ALTERNATE_check201="check21" @@ -17,23 +17,32 @@ CHECK_ALTERNATE_check201="check21" check21(){ trail_count=0 # "Ensure CloudTrail is enabled in all regions (Scored)" + REGIONS=$($AWSCLI cloudtrail describe-trails --query 'trailList[*].HomeRegion' --output text) + result='False' for regx in $REGIONS; do - LIST_OF_TRAILS=$($AWSCLI cloudtrail describe-trails $PROFILE_OPT --region $regx --query 'trailList[*].Name' --output text --no-include-shadow-trails) + LIST_OF_TRAILS=$($AWSCLI cloudtrail describe-trails $PROFILE_OPT --region $regx --query 'trailList[*].Name' --output text) if [[ $LIST_OF_TRAILS ]];then for trail in $LIST_OF_TRAILS;do - trail_count=$((trail_count + 1)) - MULTIREGION_TRAIL_STATUS=$($AWSCLI cloudtrail describe-trails $PROFILE_OPT --region $regx --query 'trailList[*].IsMultiRegionTrail' --output text --trail-name-list $trail) - if [[ "$MULTIREGION_TRAIL_STATUS" == 'False' ]];then - textFail "$trail trail in $regx is not enabled in multi region mode" - else - textPass "$trail trail in $regx is enabled for all regions" - fi + trail_count=$((trail_count + 1)) + MULTIREGION_TRAIL_STATUS=$($AWSCLI cloudtrail describe-trails $PROFILE_OPT --region $regx --query 'trailList[*].IsMultiRegionTrail' --output text --trail-name-list $trail) + ISLOGGING_STATUS=$($AWSCLI cloudtrail get-trail-status --region $regx --name $trail --query ['IsLogging'] --output text) + INCLUDEMANAGEMENTEVENTS_STATUS=$($AWSCLI cloudtrail get-event-selectors --region $regx --trail-name $trail --query EventSelectors[*].IncludeManagementEvents --output text) + READWRITETYPE_STATUS=$($AWSCLI cloudtrail get-event-selectors --region $regx --trail-name $trail --query EventSelectors[*].ReadWriteType --output text) + + echo $MULTIREGION_TRAIL_STATUS $ISLOGGING_STATUS $INCLUDEMANAGEMENTEVENTS_STATUS $READWRITETYPE_STATUS [ "$INCLUDEMANAGEMENTEVENTS_STATUS" == *"True"* ] + if [[ "$MULTIREGION_TRAIL_STATUS" == "True" ]] && [[ "$ISLOGGING_STATUS" == "True" ]] && [[ "$INCLUDEMANAGEMENTEVENTS_STATUS" == *"True"* ]] && [[ "$READWRITETYPE_STATUS" == *"All"* ]];then + textPass "$trail trail in $regx is enabled for all regions" + result='True' + break + fi done fi done - + if [[ $result == 'False' ]]; then + textFail "trail exist but it is not enabled in multi region mode" + fi if [[ $trail_count == 0 ]]; then - textFail "No CloudTrail trails were found in the account" - fi + textFail "No CloudTrail trails were found in the account" + fi }